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Intelligent or autonomous control of an entire spacecraft is a major technology that must 
be developed to enable NASA to meet its human exploration goals. NASA’s current long 
term human space platform, the International Space Station, is in low earth orbit with 
almost continuous communication with the ground based mission control. This permits the 
near real-time control by the ground of all of the core systems including power. As NASA 
moves beyond Low Earth Orbit, the issues of communication time-lag and lack of 
communication bandwidth beyond geosynchronous orbit does not permit this type of 
operation. This paper presents the work currently ongoing at NASA to develop an 
architecture for an autonomous power control system as well as the effort to assemble that 
controller into the framework of the vehicle mission manager and other subsystem 
controllers to enable autonomous control of the complete spacecraft. Due to the common 
problems faced in both space power systems and terrestrial power system, the potential for 
spin-off applications of this technology for use in micro-grids located at the edge or user end 
of terrestrial power grids for peak power accommodation and reliability are described. 


Nomenclature 


AMPS 

BCDU 

ISS 

MBSU 

PDU 

RBI 

RPC 


Advanced Modular Power Systems 
Battery Charge/Discharge Unit 
International Space Station 
Main Bus Switching Unit 
Power Distribution Unit 
Remote Bus Isolator 
Remote Power Controller 


I. Introduction 

N ASA’s present strategy for human exploration of the solar system is to “utilize incremental steps to steadily 
build, test, refine and qualify capabilities that lead to affordable flight elements and a deep space capability.” 
This runs the gamut from initial exploration missions which focus primarily on visitations to the International Space 
Station (ISS) to “Expanding human presence into the solar system and to the surface of Mars to advance 
exploration...” 1 To accomplish each of these steps, it will be necessary to develop new technologies. Many of these 
technologies will take many years to develop, hence, work commences now so that they will be ready when they are 
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needed. One of the technologies that will be needed and must be addressed now is the automation of core 
subsystems of the spacecraft including, power, communications, thermal, avionics, propulsion, etc. The rationale 
for this is quite straightforward. Currently, initial human exploration missions take place aboard the ISS in low 
earth orbit. Communications with the station are nearly instantaneous (taking into account that they flow through 
the Tracking and Data Relay Satellite network in geosynchronous orbit). Consequently, most of the core systems of 
the ISS can either be operated from the ground or operated with a great deal of real-time ground intervention. 

Contrast this with a mission to Demos and/or Phobos or a mission to the planet Mars that involves a total travel 
time of 6 to 9 months, and communication delays that can vary anywhere from 6 to 44 minutes 2 roundtrip. Because 
the communication delays are so long, the mission control center on earth will no longer have the ability to assist the 
astronauts in real-time to diagnose and correct problems with the spacecraft. In addition, it is expected that the 
astronauts that will undertake such missions will not be domain experts in the respective subsystems required to 
operate the spacecraft. Consequently, each of the subsystems will have to have built into it a substantial amount of 
intelligence to permit its routine operation as well as fault diagnosis and corrective actions. 

This paper describes development of an Intelligent Power Control system that can be used for autonomous 
power control for a deep space exploration spacecraft. This begins with a discussion of the current and future power 
architectures that will be supported by this type of autonomous controller. It then describes how this controller 
would fit into the controller architecture for the entire spacecraft. To develop the type of controller envisioned, it 
will be necessary to employ a detailed real-time simulation to evaluate its performance and ultimately verify its 
functionality. The strategy to develop this type of simulation is outlined. Finally, a discussion is presented on 
complementary applications such as micro-grids that are located at the edge (users) of terrestrial power grids for 
peak power accommodation and reliability. 


II. Power System Architecture 

Figure 1 is notional power architecture for a prospective Deep Space Vehicle. Based on studies conducted in 
over the last few years 3 , a configuration similar to this system could be used for initial deep space operations and 
would require an intelligent controller to manage operation. 

The overall system consists of a Power Module and a Habitation Module. The Power Module can provide 
approximately 16kW average power to the user loads. It is characterized by two independent power channels with 
multi-level cross strapping. Each channel has a 12 kW solar array and 1 10 Amp hours of Lithium Ion batteries. The 
large arrays and batteries are needed because even though the vehicle is projected to fly in deep space there are also 
potential Design Reference Missions 3 that require operation in environments such as low lunar orbit with an orbital 
eclipse/insolation time of 30 and 60 minutes respectively. Each independent power channel is 120V and is 
compatible with SAE spec AS 5698 4 . Each channel has a solar array regulator to provide conditioned power to the 
Main Bus Switching Unit (MBSU). From the MBSU, the power is used to charge the battery during insolation 
(through the battery charge/discharge unit, BCDU), or is distributed to the Power Distribution Units (PDUs), which 
feed the user loads. For redundancy and reliability considerations, the MBSUs can be cross-strapped and each PDU 
can be fed from either power channel. Finally, the MBSU can also feed bi-directional converters that can supply or 
draw power from the three Habitat Module docking ports. 
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Logistics Module Bus 



BCDU : Battery Charge / Discharge Unit 

MBSU : Main Bus Switching Unit 

PDU : Power Distribution Unit 

RPCM : Remote Power Controller Module 

SARU : Solar Array Regulator Unit 


Figure 1. Notional Deep Space Vehicle Power Architecture 


III. Power Controller Architectures 

Typical controller architecture for a spacecraft is shown in Figure 2. This figure shows that each of the critical 
subsystems has a reactive control which performs the high speed control of the respective subsystem. For the power 
system this would include the trip function of the remote power controllers (solid state switches) or the regulator 
loops on the devices such as the solar array regulator or the battery charge/discharge control. Each of these reactive 
control loops report status to the on-board spacecraft controller which in turn reports status to the ground control. 
For flight systems such as the ISS, human ground controllers interpret ISS status and make critical decisions based 
on experience and mission objectives. The ground controllers may choose to alter the power profile, adjust reactive 
controller set points and enable or disable loads to meet the mission objectives. A key role of the ground controller 
is to respond to fault conditions and develop workaround plans that restore the system to hilly operational status. 
Finally, the ground operator’s role is to observe trends and anticipate the onset of problems and take corrective 
action to eliminate a potential fault or mitigate its impact on the system. 

Once this type of information has been developed by ground control, it is then communicated to the spacecraft’s 
controller which then relays it to the respective subsystem. Although this type of system works well in Low Earth 
Orbit; as human exploration pushes to Cis-Lunar space and beyond, the roundtrip communication time becomes 
more of an issue. Therefore, this type of system will not support the needs and constraints of human missions. 
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Figure 2. Simplified Spacecraft Controller Architecture 


IV. Intelligent Power Control Architecture 

A potential autonomous spacecraft controller architecture is shown in Figure 3 and discussed in detail in 
Reference 5. In this architecture, each of the subsystems has an autonomous controller that interfaces with the 
respective subsystem reactive control. The autonomous controller for each subsystem manages local control issues 
and reports global information and issues to the spacecraft Mission Manager. For the following discussion, the 
autonomous controller for power will be referred to as the Intelligent Power Control. The local control problems 
from an Intelligent Power Control standpoint include items such as managing the energy availability, managing the 
power distribution network as well as detecting and reporting system failures. These functions are discussed in 
detail later in this section. 

The spacecraft Mission Manager is responsible for managing global issues between the various subsystems as 
well as crew time and mission objectives. From the power system perspective, the most important global issue is 
load scheduling. The spacecraft’s Mission Manager will provide a load schedule to the Intelligent Power Controller 
based on mission priorities, crew availability and inputs that it has received from the autonomous controls of the 
other subsystems. 

Furthermore, because the Mission Manager has a global perspective of vehicle status provided by all of the 
subsystems, it is able to diagnose the root cause of faults that manifest themselves across more than one system. 
The space craft Mission Manager is then able to provide recommendations and directions to multiple subsystems to 
mitigate and correct the effects of power system wide faults. 

Finally, the Mission Manager works in concert with ground control oversight and the crew oversight to support 
mission planning, fault diagnosis, etc. Flowever, because of the long communication delays it is assumed that the 
on-board Mission Manager has sufficient capability to handle routine events. The mission oversight function then 
would become an advise and consent function as opposed the current method where all of the critical decisions are 
made on the ground. 
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Figure 3. Intelligent Spacecraft Controller Architecture 

Figure 4 is an expanded view of the Intelligent (Autonomous) Power Controller architecture in Figure 3. An 
early implementation of this architecture that incorporated a subset of the functions shown in Figure 3 has been 
developed using highly distributed software agents. This effort is discussed in detail in Reference 5. This 
architecture is a temporal hierarchy with the highest bandwidth elements being closest to the power components. 
Thus, the highest bandwidth elements are in the Reactive Control layer where each of the power system components 
(solar array, batteries, switchgear, power converters) has its own high bandwidth controller. The reactive controllers 
report critical telemetry data to the higher level control functions so that the system can operate under routine as well 
as fault conditions. The next layer of control receives data from the reactive layer and performs the functions of 
Energy Management and Power System Network Management by utilizing elements of the Power System 
Modelling function. 

Data continues to flow up the hierarchy to the Fault Management function. This function provides for the long 
term monitoring of the hardware within the power system as well as for monitoring the state of the power system 
and the development of recovery strategies once the reactive control layer has isolated a fault and the Energy 
Management / Network Managements layer have identified the failure. 

At the top of the power controller hierarchy is the Power Channel /Vehicle Coordination function. This acts as 
communications and coordination hub for the power system. The control structure shown in Figure 4 can control an 
entire vehicle power system or can be a cooperative element in a set of like control structures. For example, there 
may be two or more of the intelligent control structures, each dedicated to an individual power channel. For 
example, the ISS this would mean eight individual controllers - one for each channel. For a deep space habitation 
system there could be two controllers, one for the Habitation module and one for the Power Module. 

Finally the Power Channel/Vehicle Coordination functions provides information that is needed for global 
decision making to the Mission Manager so that it can merged with data from other subsystems. The Mission 
Manager can then make the global decisions that need to take into account the entire mission needs as well as the 
status of all of the other spacecraft subsystems. 
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To Mission Manager 



Figure 4. Intelligent Power Control Architecture 

Each of the boxes shown in Figure 4 can be further decomposed into other lower level functions and actions. 
Shown below is a high level description and breakdown of the sub -functions for each on the boxes: 

A. Energy Management 

Operate and monitor the power generation and energy storage system based on external vehicle constraints as 
well as the system state. These functions include: 

1) Maximize power availability 

2) Maximize available energy storage for contingencies 

3) Provide a power availability timeline 

4) Provide set points for array pointing 

5) Provide voltage set points for array regulation 

6) Provide battery charge and discharge set points 

7) Detect and report failures in the power generation and storage system 

B. Power Systems Network Management 

Operate and monitor the power distribution network based on load constraints as well as the overall system 
state. These functions include: 

1) Maintain the overall power network security - ensuring that cables are not overloaded and that thermal, 
configuration, and safety constraints are satisfied 

2) Maintain power quality - principally voltage constraints throughout the distribution system 

3) Detect soft faults within the distribution system 

4) Report hard faults within the distribution system 

5) Send configuration information (on / off status) to the remote power controllers in the system 


C. Power System Model 

For a control of this type to operate, there needs to be high fidelity models of the power system that various 
control blocks can use to make decisions regarding control actions. This block provides the models and other 
computational capability to support those decisions and actions. These functions include: 
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1) Model power generation incorporating both vehicle orbital parameters and solar array shadowing constraints 

2) Model energy storage 

3) Model power network (Load flow model of the distribution system) 

4) Power System State Estimator 

D. Power System Fault Management 

This block manages the power system under faulted conditions and provides options for system recovery 
when the fault is isolated to the power system. In situations where the faidts propagate to other systems it works in 
concert with the spacecraft Mission Manager to provide power system options to resolve the issue. These functions 
include: 

1) Assesses and reports the state of the power system (Normal, Emergency, and Restorative) to the other 
autonomous (intelligent) control blocks and to the spacecraft Mission Manager. Reference 6. 

2) Performs contingency analysis utilizing the power system models and sensed data 

3) Recommends corrective actions based on the contingency analysis 

4) Perform data trend analysis to monitor component long term health 

E. Power Channel/ Vehicle Coordination 

This block manages the communication between the Intelligent Power Control and the Spacecraft Mission 
Manager. In addition, it manages communication with other power channels and/or other power systems if the 
overall power system is made up of two or more vehicles interconnected to form one large power system. In the 
case where the two vehicles are connected, the Power Channel / Vehicle Coordinators would work collaboratively 
together to manage the total connected power system. These functions include: 

1) Communicate power system status to spacecraft Mission Manager 

2) Accept commands from the spacecraft Mission Manager 

3) Negotiate power channel/vehicle load profile(s) with identical entities in other channels and vehicles to 
maximize power availability etc. based on generation capacity, energy storage, fault condition, etc. 

Each one of the control blocks consists of complex functions that need to be executed for the automated control to 
be operational. This is especially true of the power system fault manager that needs to analyze contingencies and 
provide corrective actions recommendations to the spacecraft Mission Manager. 


V. Spacecraft Mission Manager and Intelligent Power Control Interfaces 

One of the key elements necessary to the development of an Intelligent Power Controller is the definition of the 
external interfaces; one interface exists to the spacecraft Mission Manager and one to the reactive controls located in 
the power system hardware. A high-level diagram of these interfaces is shown in in Figure 5. The interface from 
the Reactive Controllers to the Intelligent Power Control shows all of the sensed variables that the Intelligent Power 
Controller needs to take control actions. These include array output voltage, battery charge / discharge voltages and 
currents, main bus and secondary bus currents and voltages, as well as the switchgear positions of all of the 
switching elements. This data, along with information from the Mission Manager is utilized by the Intelligent 
Power Controller to generate set points for the reactive layer such as array voltage set points, battery charge / 
discharge set points, RPC trip levels etc. 

The interface between the spacecraft Mission Manager and the Intelligent Power Controller is more complex as 
it must enable the two systems to work together collaboratively. In addition, the information that must be 
exchanged is highly dependent on the prevailing operational constraints of the reactive layer, the vehicle 
configuration and operational environment. The primary purpose of this interface is to develop a plan for which 
system loads will be used at which time. The Mission Manager has the information necessary to develop a plan 
based on the state of all vehicle subsystems, crew time, and mission objectives. The Intelligent Power Controller 
will work with the Mission Manager to develop a load schedule that is feasible from a power perspective. 

For a deep space exploration vehicle, and similar spacecraft, the Mission Manager needs to provide state vector 
information in addition to any mission constraints (traffic arrival schedule, viewing angle for science observation, 
etc.) so that any limitations on the pointing of the solar arrays can be taken into account. The Intelligent Power 
Controller accounts for these limitations along with state of charge of the batteries and the state of the power 
distribution system in order to provide the mission manager with a power availability profile for the planning period. 
The Mission Manager then develops an individual load profile and provides it to the Intelligent Power Controller for 
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detailed analysis, plan validation and execution. F urther information on this interchange can be found in Reference 

7. 

The Spacecraft Mission Manager also provides the Intelligent Power Controller with the Operations State of the 
other subsystems on-board the vehicle. This permits the Intelligent Power Controller to take into account this 
information when providing the Mission Manager potential corrective action recommendations in the event of a 
failure. Finally, the Intelligent Power Controller must provide the Mission Manager with the operating state of the 
EPS, the state of health of all of the power system hardware, as well as any caution and warning alarms generated by 
the power system. In the case where two vehicles are connected together, their respective Power Channel / Vehicle 
Coordinators must collaborate to provide the mission manager with unified view of the power system. 


• Navigation Vectors 

• T raffic / Array Pointing 
Constraints 

• Spacecraft (other 
subsystems) Operations 
State 

• Proposed load profile 


• Array Pointing 

• Array Voltage S.P. 

• Battery Charge/Discharge 
SP. 

• Switchgear Positions 



Energy Availability 
Load Profile Evaluation 
EPS Operating State 
EPS ORU State of 
Health 

Caution/Warning Alarms 
Proposed Corrective 
Action(s) 


Array Voltage 
Battery Voltage 
Battery Current 
Main Bus Currents 
Main Bus Voltages 
Secondary Bus Voltage 
Secondary Bus Currents 
Switch States 


Figure 5. Mission Manager Intelligent Power Control Interface 


VI. Intelligent Power Controller Development and Verification 

To develop, evaluate, and verify the operation of an Intelligent Power Controller, it is necessary to run the 
control against a representative power system; however, it is not feasible to have all of the actual hardware necessary 
to properly accomplish this at the outset. In addition, it will be necessary to operate the controller in a large number 
of off-nominal conditions to stress the control to make sure that it is ready to safely operate the actual power 
hardware. Therefore, to successfully execute this task, a high-fidelity real-time simulation must be developed to 
exercise the control. A more detailed discussion of the overall approach can be found in Reference 8; however, an 
overview of the activity is outlined below. 

Shown below in Figure 6 is the overall strategy for the simulation development. The left hand frame of the 
figure illustrates the EPS component model library which is being constructed. This consists of detailed models of 
Photovoltaic Cells (Solar Cells) as well as battery cells. In addition, models of power electronic elements are also 
being built, including isolating converters and battery charge/discharge converters. These models are state space 
average models to provide sufficient fidelity to evaluate the overall system response while providing real time 
execution speed. Finally a set of both solid state (remote power controller, RPC) and mechanical switchgear 
(remote bus isolator, RBI) elements have been constructed. These devices turn on and off power to various loads 
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and busses and also permit the simulation of overloads and faults. This is critical if the power system simulation is 
to permit the evaluation of the control across its entire operating envelope. 

The center frame highlights the fact that the individual components can be combined to produce larger power 
system units and assemblies. For example, the power converters and the PV cells can be combined to simulate a 
Smart Solar Array; the battery cells and the bi-directional power converter to form a Smart Battery; and the RBI and 
RPC elements are combined into power distribution assemblies; Main Bus Switching Units (MBSUs) for RBIs and 
Power Distribution Units (PDUs) for RPCs. 

Finally, the third frame highlights the capability to combine the power assemblies into end-to-end power system 
models. By configuring the individual power assemblies, it is possible to simulate several channels of the 1SS 
power system or alternatively the two power channels for a deep space exploration vehicle. 

In order to execute the simulations shown in the 3 ld frame of Figure 6 in real time, it not only necessary to 
simplify the models using a such techniques as state space averaging, but it is also necessary to execute the model on 
multiple computer processors in parallel. Figure 7 shows the hardware architecture of the simulation environment 
that enables controller evaluation. The key to the system is the Distributed Heterogeneous Simulation (DHS) tool 
developed by PCKrause and Associates. This tool synchronizes the time -steps of simulations conducted on multiple 
logical processors and shares information between each of the simulations. More details about this tool and the 
process by which simulations can be decomposed into parallel sub problems can be found in Reference 7. 
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Figure 6. Simulation Development Strategy 
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Figure 7. Intelligent Power Control Lab Architecture 


The resulting simulation system enables the control system to interact with a dynamic power system simulation 
in real-time to investigate performance, stability, and response to faults and disturbances. Once the initial simulation 
work is completed, the control algorithm can be moved to hardware. The hardware implementation can then be 
tested against the software simulation to validate that the implementation works as expected. Finally, the software 
simulation can be replaced with actual power system hardware to conduct hardware validation as discussed in 
Reference 9. This multi-step process enables the rapid prototyping and testing of the autonomous control and 
enables technology development in a cost effective manner with minimal risk to hardware. 


VII. Terrestrial Applications Spin-Offs 

The control architecture shown in Figure 3 is similar to the operational procedure that is used in terrestrial power 
grid operation centers. The Regional Transmission Organizations that are tasked with control of the transmission 
system create plans for system operation over many horizons (from 5 minutes to 20 years). These plans include 
anticipated loads based on historical trends as well as weather forecasts, anticipated generation availability, and 
network state. The regional grids coordinate with each other to exchange power when local deficiencies are 
predicted. The energy management function is cast into an Economic Dispatch problem which attempts to optimally 
use the available generators to meet anticipated load within the constraints of the transmission system. The plan is 
implemented by issuing commands to hardware throughout the system as well as commands to generators. Once 
operating in real time, the transmission system is constantly being monitored and a model of the system is 
constructed against which fault contingencies are analyzed to enable the operator to maximize system stability. All 
of these functions are done in a centralized manner by software with all decision making left to trained and 
experienced system operators. 

While the spacecraft autonomous power controller is controlling a comparatively small DC electrical power 
system, the lessons learned and control techniques developed are almost directly applicable to the AC terrestrial 
system. This is particularly true in the case where there are micro grids at the edge of terrestrial power distribution 
networks. An example of one of these micro grids is shown in Figure 8. These micro grids can consist not only of 
power feeds from a utility but also local generation capability such as natural gas and geothermal generators as well 
as renewable sources such as wind and solar. In addition, it is expected to that these micro grids would also contain 
energy storage in the form of batteries, compressed air, fuel cells, etc. The management of the diverse resources 
under normal operating conditions as well as fault conditions poses a unique challenge. Typically, they will not be 

10 

American Institute of Aeronautics and Astronautics 












actively managed by either the utility or the end user directly; however, they will need sufficient management and 
control to insure that they provide secure reliable power under a variety of operating conditions. The control shown 
in Figures 3 and 4 can provide this type of capability. By first implementing this control on a spacecraft, there is a 
minimum of historical legacy to overcome. The experience gained from this implementation, can serve as a test bed 
for terrestrial development to facilitate its application and acceptance. 
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Figure 8. Terrestrial Micro Power Grid 


VIII. Summary 

Deep-space manned exploration requires autonomous control of all spacecraft systems to safely and effectively 
complete the desired missions. As a step along that path, NASA Glenn Research Center has begun development of 
an Intelligent Power Controller to meet this need. Collaboration with NASA Ames Research Center has highlighted 
how this Intelligent Power Controller can be integrated with a mission manager to begin the process of building a 
completely autonomous spacecraft. A path to develop and validate the Intelligent Power Controller has been 
identified which is comprised of initial software simulation, followed by hardware-in-the-loop testing, ultimately 
leading to complete hardware implementation. The lessons learned from this process can be applied to control of 
terrestrial power systems, particularly micro-grids. 
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